LEGAL PROTECTION OF MARKETPLACE USERS' PERSONAL DATA FROM THE PERSPECTIVE OF THE PERSONAL DATA PROTECTION LAW

Abstract

The rapid growth of online marketplaces in Indonesia has made the collection and processing of consumers' personal data an integral part of everyday commerce, encompassing identity information, payment and financial details, delivery addresses, transaction history, and behavioural data used for targeted advertising. This large-scale accumulation of personal data by marketplace platforms creates significant exposure to misuse, unauthorised disclosure, and security breaches, as illustrated by well documented incidents affecting major Indonesian e-commerce platforms. This article examines the legal protection afforded to marketplace users' personal data under Law Number 27 of 2022 concerning Personal Data Protection (UU PDP), Indonesia's first comprehensive, cross-sectoral data protection statute. Using a normative juridical method with statutory, conceptual, and case-based approaches, this study analyses how the UU PDP's data subject rights, controller and processor obligations, breach notification requirements, and administrative and criminal sanctions apply to the marketplace context, and evaluates these protections against the classical Indonesian legal-protection theory distinguishing preventive from repressive protection. The study finds that the UU PDP substantially strengthens the legal position of marketplace users by, for the first time, imposing an explicit, time-bound breach notification duty, requiring a documented lawful basis and, in most cases, explicit consent for processing, and creating both administrative sanctions enforceable by a dedicated supervisory authority and criminal penalties for unlawful collection, disclosure, use, or falsification of personal data. At the same time, the study identifies persisting gaps in practical protection, including the continuing prevalence of take-it-or-leave-it consent mechanisms embedded in marketplace terms of service, extensive and often opaque data sharing with third-party logistics, payment, and advertising partners, unresolved questions concerning cross-border transfer of user data to overseas cloud infrastructure, andthe still-developing institutional capacity of Indonesia's Personal Data Protection Supervisory Authority. The article concludes that effective protection of marketplace users' personal data requires not only continued reliance on the UU PDP's civil, administrative, and criminal mechanisms but also sector-specific implementing regulation for electronic commerce and strengthened institutional enforcement capacity.